GCVE-110-OSM-2026-14401

Malicious package. `@notrainer/nobtrainer-sdk` is an npm package that exfiltrates sensitive data on the victim host to an attacker-controlled Discord webhook. The same Discord webhook endpoint (ID 1433690093175967776) is also used by the npm package `@johnruff215-dev/solana-wallet-tracker`, indicating both belong to a single actor/campaign. Classification: information stealer. The package provides no legitimate functionality, so all published versions are malicious. Full indicators are published at the reference below. ENTRY dist/index.js (main: dist/index.js) DESTINATION - 1 exfil (discord-webhook) (values recorded in verified_iocs) EXFIL - Webhook Data Exfiltration in dist/index.js: "discord.com/api/webhooks/1433690093175967776/M-6XGbPIpmhkkleZgRqn0CJH4Icm_71Gvi-..." - Webhook Data Exfiltration in src/index.ts: "discord.com/api/webhooks/1433690093175967776/M-6XGbPIpmhkkleZgRqn0CJH4Icm_71Gvi-..." - Network Request in src/index.ts: "axios.post(" ADDITIONAL FINDINGS - Chai-Max Wallet Theft Indicators in package.json: "Solana wallet" PAYLOAD FILES src/index.ts (+ dist/index.js)